Analysis

  • max time kernel
    153s
  • max time network
    45s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    16/06/2022, 09:40

General

  • Target

    QvtGA0YrRh9C60LAueGxzeA==?=.xlsx

  • Size

    10KB

  • MD5

    61822d2d7da9613771ffc5fcb76d467d

  • SHA1

    d4681e9afd2c843b7828ff715995c0768ef4ef4c

  • SHA256

    a3179c79c2e79c41ff4a3ae307c65e1b50780235661a238afcba75365bb9ce5f

  • SHA512

    72e8ffb8a584550430e78e49aa4ed0ecd41bfc2933d787fc945a839c884d92885ce3d8b3dcff0b45a809316ed71d6189bc85a920956c033bcb941e32de635a92

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\QvtGA0YrRh9C60LAueGxzeA==_=.xlsx
    1⤵
    • Enumerates system info in registry
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:1516

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/1516-54-0x000000002FAC1000-0x000000002FAC4000-memory.dmp

          Filesize

          12KB

        • memory/1516-55-0x0000000070F01000-0x0000000070F03000-memory.dmp

          Filesize

          8KB

        • memory/1516-56-0x000000005FFF0000-0x0000000060000000-memory.dmp

          Filesize

          64KB

        • memory/1516-57-0x0000000071EED000-0x0000000071EF8000-memory.dmp

          Filesize

          44KB

        • memory/1516-58-0x00000000755A1000-0x00000000755A3000-memory.dmp

          Filesize

          8KB